# US Treasury Sanctions 1VPNS VPN Service and Cryptor Seller for Enabling Ransomware Operations (linked to FSB Center 16 Router Exploitation via CVE-2018-0171/CVE-2008-4128)

> OFAC sanctioned First VPN Service (1VPNS), its administrator Dmytro Rashevskyi, and Belarusian cryptor seller Yevgeniy Vladimirovich Silayev on July 13, 2026 for enabling ransomware groups (Anubis, Qilin, Sinobi) to obscure attack origins and evade detection, coordinated with UK/EU sanctions on 24 individuals/entities including GRU Unit 29155 leadership and Lumma Stealer operators. The action follows a joint CISA/NSA/FBI/international advisory (AA26-194A) on Russian FSB Center 16 (Berserk Bear/Energetic Bear, Military Unit 71330) exploiting default SNMP credentials on poorly configured routers, including active exploitation of CVE-2018-0171 (Cisco Smart Install RCE) and the decade-old end-of-life CVE-2008-4128 (Cisco IOS CSRF).

- **Published:** 2026-07-14T00:00:00Z
- **Last reviewed:** 2026-07-14T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1290
- **ID:** TL-2026-1290
- **Severity:** MEDIUM (CVSS 9.8)
- **Category:** THREAT_INTEL
- **Status:** ACTIVE
- **Actor:** FSB Center 16 (Russia)
- **Detections:** 9 · **IOCs:** 21 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2018-0171, CVE-2008-4128

## Description

On July 13, 2026, the U.S. Department of the Treasury's Office of Foreign Assets Control (OFAC) designated First VPN Service (1VPNS), a VPN provider operational since 2014, along with its administrator Dmytro Rashevskyi (a 45-year-old Ukrainian national who used the aliases 'Maksim Sorin' and 'Roman Chabanenko' to procure infrastructure from providers that would otherwise refuse service due to abuse complaints), and Belarusian national Yevgeniy Vladimirovich Silayev, who supplied 'cryptor' malware-obfuscation services. 1VPNS marketed itself as a no-logs, law-enforcement-non-cooperative VPN and was purchased by ransomware groups to anonymize command infrastructure and manage stolen victim data; its website and supporting infrastructure were dismantled in a May 2026 joint European/North American law enforcement operation supported by the FBI's Boston Field Office. OFAC blockchain analysis (corroborated by TRM Labs) tied 1VPNS wallet infrastructure to payments from at least three named ransomware operations: Anubis ransomware (~$715 in Dec 2025/Mar 2026), Qilin ransomware (~$120 on 2026-01-11), and Sinobi Group (~$58 on 2026-02-08). OFAC designated 5 cryptocurrency addresses (BTC/ETH/LTC/TRX) tied to 1VPNS hosted at the Cryptomus exchange and 15 addresses (BTC/ETH/TRX/LTC/DOGE/DASH/ZEC/SOL) tied to Rashevskyi personally; no addresses were listed for Silayev. The designations were issued under Executive Order 13694 (as amended, standing cyber-sanctions authority) and reference Executive Order 14390 (March 2026), which directs U.S. agencies to harden systems against foreign cybercrime. Treasury states ransomware groups using these enablers' services caused billions of dollars in losses to American businesses and critical infrastructure providers. The action was coordinated internationally: the UK Foreign, Commonwealth & Development Office (FCDO) and the EU simultaneously sanctioned 24 additional individuals/entities (UK) and 9 individuals/4 entities (EU) tied to a cyberespionage/sabotage network targeting European governments and critical infrastructure (heating and power plants) since 2010. UK designations named GRU senior leadership Vyacheslav Stafeyev, Ivan Senin, and Ivan Kasyanenko for directing GRU Unit 29155's cyber/hybrid operations, which collaborated with the company IMPULS to recruit hackers from Russian universities, and separately sanctioned individuals behind Lumma Stealer, an information-stealing malware attributed to at least 2,100 UK victims in the prior six months per the National Crime Agency, with stolen credentials reportedly reused by Russian state actors for espionage. 

The sanctions package explicitly links to a parallel joint cybersecurity advisory (CISA AA26-194A, 'Improve Router Hygiene to Protect Against Russian State-Sponsored Targeting,' co-published with NSA, FBI, and 12 partner countries including Australia's ACSC/ASD) describing years-long exploitation by Russian FSB Center 16 — assessed by US/UK governments as almost certainly synonymous with the long-tracked APT cluster 'Berserk Bear' (aka Energetic Bear, Dragonfly, Dragonfly 2.0, Crouching Yeti, BROMINE, DYMALLOY, Ghost Blizzard, IRON LIBERTY, Koala, TeamSpy, Havex), formally Military Unit 71330 / the 'Center for Radio-Electronic Intelligence by Means of Communication' (TsRRSS), the FSB's core SIGINT arm. Center 16 actors conduct broad scanning to identify poorly configured, internet-exposed routers, specifically probing for SNMP agents (v1/v2c) that accept common or default community strings. Once access is obtained, actors send crafted SNMP Set-Requests (often from spoofed source IPs) with Object Identifiers (OIDs) instructing the device to copy its running configuration and transmit it via TFTP to attacker-controlled infrastructure — either a leased VPS or a compromised FTP server — enabling large-scale, low-cost reconnaissance and mapping of critical-infrastructure network topology. Since at least November 2021 the same unit has also exploited CVE-2018-0171, a critical (CVSSv3.1 9.8) unauthenticated remote code execution / denial-of-service flaw in the Cisco IOS/IOS XE Smart Install feature (crafted message to TCP port 4786, out-of-bounds write per CWE-787, improper input validation per CWE-20), patched by Cisco in March 2018 and added to the CISA KEV catalog November 3, 2021. The advisory also flags continued opportunistic exploitation of CVE-2008-4128, a set of CSRF vulnerabilities (CWE-352) in the HTTP administration component of Cisco IOS 12.4 on 871 Integrated Services Routers — a vulnerability affecting only end-of-life hardware, illustrating the actor's reliance on unpatched legacy edge devices as durable footholds. CISA's primary mitigation guidance: disable Cisco Smart Install where not actively required, migrate from SNMP v1/v2c community strings to SNMPv3 with strong authentication and encryption, patch or replace end-of-life devices, and apply standard router-hardening hygiene (disable unused services, restrict management-plane access, monitor for unauthorized configuration exfiltration).

## MITRE ATT&CK

- T1595.001 Scanning IP Blocks
- T1583.003 Virtual Private Server
- T1585 Establish Accounts
- T1190 Exploit Public-Facing Application
- T1078.001 Default Accounts
- T1059 Command and Scripting Interpreter
- T1505 Server Software Component
- T1027 Obfuscated Files or Information
- T1027.002 Software Packing
- T1685 Disable or Modify Tools
- T1110.001 Password Guessing
- T1555 Credentials from Password Stores
- T1046 Network Service Discovery
- T1040 Network Sniffing
- T1119 Automated Collection
- T1602.002 Network Device Configuration Dump
- T1090.002 External Proxy
- T1090.003 Multi-hop Proxy
- T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol
- T1020 Automated Exfiltration
- T1486 Data Encrypted for Impact
- T1498 Network Denial of Service

## Sources

- [U.S. Sanctions First VPN Service and Malware Cryptor Seller](https://thehackernews.com/2026/07/us-sanctions-first-vpn-service-and.html)
- [Treasury Sanctions Malware and Infrastructure Providers Supporting Ransomware Attacks Against Americans](https://home.treasury.gov/news/press-releases/sb0559)
- [OFAC Sanctions FirstVPN and Ransomware Enablers Behind Attacks on Americans](https://www.trmlabs.com/resources/blog/ofac-sanctions-firstvpn-and-ransomware-enablers-behind-attacks-on-americans)
- [Sanctioning Ransomware Enablers in Coordinated International Action](https://www.state.gov/releases/office-of-the-spokesperson/2026/07/sanctioning-ransomware-enablers-in-coordinated-international-action)
- [VPN service favored by ransomware groups is sanctioned by US](https://therecord.media/first-vpn-administrator-us-sanctions-ransomware-groups)
- [Improve Router Hygiene to Protect Against Russian State-Sponsored Targeting (AA26-194A)](https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-194a)
- [Improve Router Hygiene to Protect Against Russian State-Sponsored Targeting](https://www.cyber.gov.au/about-us/view-all-content/alerts-and-advisories/improve-router-hygiene-to-protect-against-russian-state-sponsored-targeting)
- [Russian FSB Center 16 exploits decade-old Cisco flaw in cyber espionage campaign to target critical infrastructure](https://industrialcyber.co/threats-attacks/russian-fsb-center-16-exploits-decade-old-cisco-flaw-in-cyber-espionage-campaign-to-target-critical-infrastructure/)
- [FSB Center 16 Exploited Default Router Passwords to Map Critical Infrastructure for Years](https://www.techtimes.com/articles/320356/20260713/fsb-center-16-exploited-default-router-passwords-map-critical-infrastructure-years.htm)
- [NSA Urges Organizations to Disable Cisco Smart Install as Russian Hackers Target Routers](https://cybersecuritynews.com/nsa-disable-cisco-smart/)
- [FBI Warns FSB-Linked Hackers Exploiting Unpatched Cisco Devices for Cyber Espionage](https://thehackernews.com/2025/08/fbi-warns-russian-fsb-linked-hackers.html)
- [Russian State-Sponsored and Criminal Cyber Threats to Critical Infrastructure (AA22-110A)](https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-110a)
- [UK and EU strike Russian cyber networks with new sanctions](https://www.gov.uk/government/news/uk-and-eu-strike-russian-cyber-networks-with-new-sanctions)
- [EU and Britain Target Russian Intelligence Officers Over a Major Cyberspying Campaign](https://www.usnews.com/news/world/articles/2026-07-13/eu-targets-russian-intelligence-officers-accused-of-running-a-yearslong-cyber-spying-campaign)
- [NVD - CVE-2018-0171](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2018-0171)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1290